@tanakayuto/intmax402-core 0.1.2 → 0.2.1

package/dist/nonce.d.ts

@@ -5,5 +5,6 @@
 export declare function generateNonce(secret: string, ip: string, path: string, bindIp?: boolean): string;
 /**
  * Verify a nonce. Checks current and previous window for clock skew tolerance.
+ * Uses timingSafeEqual to prevent timing attacks.
  */
 export declare function verifyNonce(nonce: string, secret: string, ip: string, path: string, bindIp?: boolean): boolean;

package/dist/nonce.js

@@ -21,6 +21,7 @@ function generateNonce(secret, ip, path, bindIp = false // ← false = AIエー
 }
 /**
  * Verify a nonce. Checks current and previous window for clock skew tolerance.
+ * Uses timingSafeEqual to prevent timing attacks.
  */
 function verifyNonce(nonce, secret, ip, path, bindIp = false) {
     const window = getTimeWindow();
@@ -30,8 +31,13 @@ function verifyNonce(nonce, secret, ip, path, bindIp = false) {
             ? `${w}:${ip}:${path}`
             : `${w}:${path}`;
         const expected = (0, crypto_1.createHmac)("sha256", secret).update(data).digest("hex");
-        if (expected === nonce)
+        // Fix 4: Use timingSafeEqual to prevent timing attacks
+        // Both expected and nonce must be valid hex strings of the same length
+        if (expected.length === nonce.length &&
+            /^[0-9a-f]+$/i.test(nonce) &&
+            (0, crypto_1.timingSafeEqual)(Buffer.from(expected, "hex"), Buffer.from(nonce, "hex"))) {
             return true;
+        }
     }
     return false;
 }

package/dist/parse.js

@@ -36,6 +36,16 @@ function parseAuthorization(header) {
     }
     if (!result.address || !result.nonce || !result.signature)
         return null;
+    // Fix 6: Input length validation to prevent malformed/oversized inputs
+    // address: 42 chars (0x + 40 hex), nonce: 64 chars (sha256 hex), signature: 132 chars (0x + 130 hex)
+    if (result.address.length !== 42)
+        return null;
+    if (result.nonce.length !== 64)
+        return null;
+    if (result.signature.length !== 132)
+        return null;
+    if (result.txHash && result.txHash.length > 128)
+        return null;
     return {
         address: result.address,
         nonce: result.nonce,

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@tanakayuto/intmax402-core",
-  "version": "0.1.2",
+  "version": "0.2.1",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "typecheck": "tsc --noEmit"
+  },
   "dependencies": {},
   "devDependencies": {
     "typescript": "^5.4.0",
@@ -28,10 +33,5 @@
     "express",
     "web3",
     "zk"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "clean": "rm -rf dist",
-    "typecheck": "tsc --noEmit"
-  }
+  ]
 }